kernel/bpf/verifier.c

18908 	struct bpf_insn insn_buf[16], *insn;
18919 		cnt = ops->gen_prologue(insn_buf, env->seen_direct_write,
18921 		if (cnt >= ARRAY_SIZE(insn_buf)) {
18925 			new_prog = bpf_patch_insn_data(env, 0, insn_buf, cnt);
19060 		cnt = convert_ctx_access(type, insn, insn_buf, env->prog,
19062 		if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) ||
19071 			if (shift && cnt + 1 >= ARRAY_SIZE(insn_buf)) {
19077 					insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
19080 				insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
19084 					insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH,
19087 				insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
19092 			insn_buf[cnt++] = BPF_RAW_INSN(BPF_ALU64 | BPF_MOV | BPF_X,
19096 		new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19445 					    struct bpf_insn *insn_buf,
19451 	insn_buf[0] = addr[0];
19452 	insn_buf[1] = addr[1];
19453 	insn_buf[2] = BPF_MOV64_IMM(node_offset_reg, insn_aux->insert_off);
19454 	insn_buf[3] = *insn;
19459 			    struct bpf_insn *insn_buf, int insn_idx, int *cnt)
19497 		insn_buf[0] = BPF_MOV64_IMM(BPF_REG_1, obj_new_size);
19498 		insn_buf[1] = addr[0];
19499 		insn_buf[2] = addr[1];
19500 		insn_buf[3] = *insn;
19521 		insn_buf[0] = addr[0];
19522 		insn_buf[1] = addr[1];
19523 		insn_buf[2] = *insn;
19545 						node_offset_reg, insn, insn_buf, cnt);
19548 		insn_buf[0] = BPF_MOV64_REG(BPF_REG_0, BPF_REG_1);
19594 	struct bpf_insn insn_buf[16];
19682 			struct bpf_insn *patch = &insn_buf[0];
19697 			cnt = patch - insn_buf;
19698 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19712 			cnt = env->ops->gen_ld_abs(insn, insn_buf);
19713 			if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf)) {
19718 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19733 			struct bpf_insn *patch = &insn_buf[0];
19769 			cnt = patch - insn_buf;
19771 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19785 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_AX, BPF_REG_10, stack_off);
19786 			insn_buf[1] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_AX, 0, insn->off + 2);
19787 			insn_buf[2] = BPF_ALU64_IMM(BPF_SUB, BPF_REG_AX, 1);
19788 			insn_buf[3] = BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_AX, stack_off);
19791 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19806 			ret = fixup_kfunc_call(env, insn, insn_buf, i + delta, &cnt);
19812 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19885 			insn_buf[0] = BPF_JMP_IMM(BPF_JGE, BPF_REG_3,
19887 			insn_buf[1] = BPF_ALU32_IMM(BPF_AND, BPF_REG_3,
19891 			insn_buf[2] = *insn;
19893 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19921 			insn_buf[0] = ld_addrs[0];
19922 			insn_buf[1] = ld_addrs[1];
19923 			insn_buf[2] = *insn;
19926 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19939 				insn_buf[0] = BPF_MOV64_IMM(BPF_REG_5, (__force __s32)GFP_ATOMIC);
19941 				insn_buf[0] = BPF_MOV64_IMM(BPF_REG_5, (__force __s32)GFP_KERNEL);
19942 			insn_buf[1] = *insn;
19945 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19960 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0);
19961 			insn_buf[1] = *insn;
19964 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
19996 				cnt = ops->map_gen_lookup(map_ptr, insn_buf);
19999 				if (cnt <= 0 || cnt >= ARRAY_SIZE(insn_buf)) {
20005 							       insn_buf, cnt);
20081 			insn_buf[0] = ld_jiffies_addr[0];
20082 			insn_buf[1] = ld_jiffies_addr[1];
20083 			insn_buf[2] = BPF_LDX_MEM(BPF_DW, BPF_REG_0,
20087 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf,
20102 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
20103 			insn_buf[1] = BPF_JMP32_REG(BPF_JGE, BPF_REG_2, BPF_REG_0, 6);
20104 			insn_buf[2] = BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 3);
20105 			insn_buf[3] = BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1);
20106 			insn_buf[4] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0);
20107 			insn_buf[5] = BPF_STX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0);
20108 			insn_buf[6] = BPF_MOV64_IMM(BPF_REG_0, 0);
20109 			insn_buf[7] = BPF_JMP_A(1);
20110 			insn_buf[8] = BPF_MOV64_IMM(BPF_REG_0, -EINVAL);
20113 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
20129 				insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
20130 				insn_buf[1] = BPF_ALU64_IMM(BPF_LSH, BPF_REG_0, 3);
20131 				insn_buf[2] = BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1);
20132 				insn_buf[3] = BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0);
20133 				insn_buf[4] = BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, 0);
20134 				insn_buf[5] = BPF_MOV64_IMM(BPF_REG_0, 0);
20137 				insn_buf[0] = BPF_MOV64_IMM(BPF_REG_0, -EOPNOTSUPP);
20141 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
20155 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8);
20157 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, 1);
20170 			insn_buf[0] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -16);
20172 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, 1);
20185 			insn_buf[0] = BPF_MOV64_REG(BPF_REG_0, BPF_REG_2);
20186 			insn_buf[1] = BPF_ATOMIC_OP(BPF_DW, BPF_XCHG, BPF_REG_1, BPF_REG_0, 0);
20189 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
20235 		insn_buf[0] = BPF_ST_MEM(BPF_DW, BPF_REG_FP,
20238 		insn_buf[1] = env->prog->insnsi[subprog_start];
20240 		new_prog = bpf_patch_insn_data(env, subprog_start, insn_buf, 2);
20289 	struct bpf_insn insn_buf[] = {
20328 	*cnt = ARRAY_SIZE(insn_buf);
20329 	new_prog = bpf_patch_insn_data(env, position, insn_buf, *cnt);
20335 	/* Note: insn_buf[12] is an offset of BPF_CALL_REL instruction */